{"record":{"id":"3bfd8bebd3d5c9fe","repo":"astrid-runtime/astrid","slug":"tls-key-path-is-not-a-regular-file-refusing-t","errorCode":null,"errorMessage":"tls.key-path {} is not a regular file — refusing to boot the gateway","messagePattern":"tls\\.key-path (.+?) is not a regular file — refusing to boot the gateway","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-gateway/src/config.rs","lineNumber":159,"sourceCode":"    ///   that the rustls PEM parser would surface as bewildering\n    ///   downstream errors.\n    pub fn validate(&self) -> anyhow::Result<()> {\n        for raw in &self.cors_allow_origins {\n            validate_cors_origin(raw)?;\n        }\n        if let Some(tls) = &self.tls {\n            // `is_file()` catches both \"doesn't exist\" and \"points\n            // at a directory\". `exists()` alone would pass for a\n            // directory and fail later inside rustls with a less\n            // clear error.\n            if !tls.cert_path.is_file() {\n                anyhow::bail!(\n                    \"tls.cert-path {} is not a regular file — refusing to boot the gateway\",\n                    tls.cert_path.display()\n                );\n            }\n            if !tls.key_path.is_file() {\n                anyhow::bail!(\n                    \"tls.key-path {} is not a regular file — refusing to boot the gateway\",\n                    tls.key_path.display()\n                );\n            }\n            // Defensive: catch the copy-paste typo where cert+key\n            // point at the same file. The rustls PEM parser will\n            // happily try to load a private key out of the cert chain\n            // and produce a cryptic error; surface the problem here.\n            if tls.cert_path == tls.key_path {\n                anyhow::bail!(\n                    \"tls.cert-path and tls.key-path resolve to the same file ({}); separate them\",\n                    tls.cert_path.display()\n                );\n            }\n            crate::tls::warn_if_key_is_too_open(&tls.key_path);\n        }\n        Ok(())\n    }","sourceCodeStart":141,"sourceCodeEnd":177,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-gateway/src/config.rs#L141-L177","documentation":"TLS configuration guard in GatewayConfig::validate: the configured tls.key-path exists but is not a regular file (a directory, or otherwise non-file entry). The comment notes is_file() is used deliberately over exists() so both missing and directory cases are caught here with a clear message instead of failing later inside the rustls PEM parser with a bewildering error.","triggerScenarios":"Thrown at crates/astrid-gateway/src/config.rs:159 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Correct tls.key-path in the gateway config to point at the PEM private-key file","Check that the key file exists and is a regular file","Fix permissions/mounts if the key file was moved or not deployed"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}